This invention relates to multi-module paralleled inverter system and more particularly to a circuit for detecting when any one of the modules connected in parallel fails and isolating the failed module from the rest of the working modules [in order to shut down the module] for at least as long as the failure condition continues.
The use of active redundant inverter modules connected in parallel to a load has become a well accepted practice in the power conditioning field for spacecraft application. The practice has gained wide acceptance due to the flexibility provided by the individual modules for expanding, or reducing, power output capability, and for providing more reliable performance through redundant modules which can take over the load when one or more of the modules experiences some failure. However, since the modules operate in parallel, there is a possibility that failure of certain types in any one of the modules may result in a total system failure. For example, a total system failure could occur if the collector circuit of any one of the two power output transistors in a module opens. Total system failure occurs because the output transformer of the module having an open circuit in the collector of one power transistor will be driven into saturation since the other power transistor continues to operate in the normal manner. The saturated transformer then becomes a very heavy load for the output transformers for the other modules since they are connected in parallel by their secondary windings. This results in collector current having high spikes for each of the transistors operating in the other modules.
Such high spike collector currents could cause secondary breakdown effects in the remaining transistors and therefore possible total system failure. Breakdowns could also occur with an open circuit in the base of a power transistor, or in either the primary or secondary winding of the output transformer. Although fuse protection is provided between the secondary winding of the output transformer and the load, and between the primary windings of the output transformer and the DC power input, such protection may not operate as intended to prevent total system failure because the current spike may not have enough power to open the fuse, and yet have enough power to cause secondary breakdown effects. This problem of having the fuse open in time to prevent total system failure is aggravated by the practice of using slightly oversized fuses to permit some temporary overload operation. It would be desirable to sense a condition which may cause an overload operation and to remove the module having the condition from the system in order to prevent any possible total system failure.